Privacy Policy

1. Data We Collect

Account data

Name, email address, and password hash when you register. Company name and VAT number where provided for billing purposes.

Billing data

Subscription tier and payment status. Card details are handled entirely by our payment provider: we store only a payment reference and the last 4 digits of the card on file.

Content and brand data

Briefs, brand guidelines, tone-of-voice rules, keyword lists, and corrections you enter into the platform. This data is used to generate and improve content outputs for your account. It is not shared with other customers and is not used to train AI models.

Usage data

Pages visited, features used, article generation events, and error logs. Used to operate, debug, and improve the platform.

Technical data

IP address, browser type, operating system, and session identifiers. Collected automatically when you access the platform.

2. Legal Basis for Processing

We process personal data under the following legal bases (GDPR Article 6):

• Contract performance: account data and billing data are necessary to provide the Service you have subscribed to.
• Legitimate interests: usage and technical data to maintain security, debug, and improve the platform, where our interests do not override yours.
• Legal obligation: retaining billing records as required by applicable tax and accounting law.
• Consent: analytics and personalisation cookies, where you have provided consent via our cookie banner.

3. How We Use Your Data

• Providing, maintaining, and improving the Service.
• Processing payments and managing subscriptions.
• Sending transactional emails (account confirmation, billing receipts, password reset).
• Sending product update emails, which you can unsubscribe from at any time.
• Detecting and preventing fraud, abuse, and security incidents.
• Complying with legal obligations and responding to lawful requests from authorities.

4. AI Processing and Your Content

Content you submit (briefs, brand rules, corrections, and reference images you upload for your brand profile) is sent to our AI provider to generate article drafts and quality assessments. Our AI provider processes this data as a sub-processor on our behalf. Our AI provider's commercial terms do not allow it to train models on customer content.

Images for your articles are generated from prompts derived from the same content by a separate image generation provider, which processes this data as a sub-processor on our behalf.

We do not use your content or output to train or fine-tune any AI model, whether operated by us or a third party.

5. Our Shopify App (cpywrk Live Prices)

cpywrk Live Prices is a free Shopify app that shows current product prices and add-to-cart buttons inside blog articles cpywrk has written for a store.

What the app accesses

The app requests no permissions in your Shopify admin. When you install it, Shopify sends us your store's myshopify.com address and a one-time access token. We need the token to complete the installation. We discard it immediately, never store it, and never use it to call your store. The app adds a small script to your blog article pages only. When someone views an article, that script reads the public price of the products named in the article from your own storefront. That is the same price anyone sees on the product page. A visitor who clicks "Add to cart" in an article has that product added to the store's own Shopify cart. The script asks the store to add it, may read back the updated cart from the store so the theme's cart drawer can show it, and otherwise takes the visitor to the store's cart page. These requests go from the visitor's browser to your store only, just as the store's own add-to-cart button does. The cart belongs to the store and Shopify handles it. The script runs in the visitor's browser, is served by Shopify, and sends nothing to cpywrk. It does not collect, read or store any information about your customers or visitors.

Messages from Shopify

When the app is installed, Shopify sends our servers the store's address. Shopify also forwards three kinds of privacy request: a customer asking for their data, a customer asking for their data to be deleted, and a request to delete a store's data after uninstalling. The app holds no customer data and no store data, so there is nothing to return or delete. We confirm receipt of each request to Shopify. The only data our server sees is the store's myshopify.com domain, logged on install and when Shopify forwards a privacy request. It goes only to our hosting provider's runtime logs, is written to no database and sent to no third party. These logs are kept by our hosting provider for up to 3 days and then deleted automatically.

Removing the app

Uninstalling the app from your Shopify admin switches the script off. No data needs to be deleted afterwards, because none is kept. Questions: privacy@cpywrk.com.

6. Sub-processors and Data Sharing

We share personal data with a small number of carefully selected providers, in these categories: hosting, database and file storage, sign-in, background processing, AI text generation, AI image generation, email delivery, payments, search and analytics reporting, caching, usage analytics, and cookie consent management. Each provider is reviewed before we engage it.

Customers and prospective customers can request the full list, with each provider's name, location and transfer safeguard, by emailing security@cpywrk.com.

We notify customers at least 14 days before adding or replacing a sub-processor.

We do not sell personal data. We do not share it with advertisers or data brokers.

7. International Transfers

Some of our providers operate outside the European Economic Area (EEA). The full sub-processor list, available on request, states the transfer safeguard for each provider.

8. Data Retention

We retain account and content data for as long as your account is active. When you delete your account or your subscription is terminated, we keep your data so you can export it, and we delete it when you ask us to, at privacy@cpywrk.com. Automatic deletion at a fixed time after closure is not yet in place. Anonymised usage aggregates may be retained for longer for statistical purposes.

Billing records are retained for 7 years as required by applicable accounting regulations.

9. Your Rights Under GDPR

If you are based in the EEA, you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your data, subject to legal retention obligations.
• Portability: receive your data in a structured, machine-readable format.
• Restriction: ask us to limit processing in certain circumstances.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at privacy@cpywrk.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

10. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS) and data stored encrypted at rest (AES-256) by our database provider. No system is completely secure; we cannot guarantee absolute security.

In the event of a data breach that is likely to result in high risk to your rights and freedoms, we will notify you and relevant supervisory authorities in accordance with GDPR.

11. Cookies

We use cookies and similar tracking technologies. See our Cookie Policy for full details.

12. Children

The Service is not directed at individuals under 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently done so, contact us and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated by email at least 14 days before they take effect. The "last updated" date at the top reflects the most recent revision.

14. Contact

For privacy-related questions or to exercise your rights, contact us at privacy@cpywrk.com.